CVE-2026-15060

Medium · 4.7

CVSS

4.7

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A regular user logged into a desktop computer could stop important programs that normally require special rights, potentially disrupting work or system stability.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: High
Impact: Privilege Gain
Component: Application
Class: Authorization Bypass
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Authorization bypass in systemd-machined allowing unprivileged graphical session users to invoke register-machine and terminate arbitrary processes including privileged ones.

Why it matters to the business

Unprivileged users on affected desktop systems can disrupt operations by terminating critical processes, leading to service outages or loss of data in active sessions; low prevalence since the component is optional and not installed by default.

How an attack unfolds

An attacker with a local graphical desktop login abuses permissive polkit rules for the register-machine action in systemd-machined >= v259 to obtain the ability to kill any process on the system.

How to fix it

Remove or restrict custom polkit policies granting register-machine access to unprivileged users; uninstall the optional systemd-container package if systemd-machined is not required; upgrade systemd-machined to a version that enforces stricter authorization checks.

How to confirm the fix worked

Verify polkit rules do not grant register-machine to non-root users; confirm systemd-machined is absent or at a non-affected version; attempt process termination from an unprivileged graphical session to validate the restriction.

Typical attack path

Obtain an unprivileged graphical desktop session on a system running systemd-machined >= v259
Invoke the register-machine D-Bus method via polkit authorization
Use the resulting capability to send termination signals to arbitrary target processes

How to detect it

Review polkit and systemd-machined logs for register-machine invocations from graphical sessions; correlate with sudden termination of high-privilege processes without corresponding audit records from authorized sources.

register-machine
polkit.*register-machine
systemd-machined.*kill

What your security team should do

Audit and tighten polkit policies for register-machine on all desktop systems
Remove the systemd-container package from default installations where not explicitly needed
Add monitoring for unexpected process terminations originating from user sessions

The record

When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected

Affected packages

Ecosystem	Package	Introduced	Fixed